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(54) IVIethod and apparatus for shaft breakage detection 



(57) The present invention is addressed to a control 
logic for detennlning the occurrence of shaft decoupling 
In a gas turbine engine. The control logic in the preferred 
embodiment receives Inputs for shaft rotational speed 
and/or compressor pressure and uses these parame- 
ters for making a determination of shaft decoupling in 



fractions of a second, before serious damage to the gas 
turbine engine can occur. The control logic also utilizes 
multiple interval sampling, and sampling over multiple 
channels to verify any detenmination of shaft decou- 
pling. Once a shaft decouple has been verified, fuel flow 
to the engine is cut off, thus shutting down the engine. 
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Description 

FIELD OF THE INVENTION 

[0001] The present invention relates to a logic system 
for determining shaft failure in a gas turbine engine, and 
in particular, a method for sensing the immediate signs 
of shaft decoupling in a gas turbine engine, and an ap- 
paratus which performs these sensing functions. 

BACKGROUND OF THE INVENTION 

[0002] Gas turbine engines have been well known in 
the art for many years, and are engines in which a shaft 
containing a row of compressor blades sen/es as the 
drive shaft for generating a thrust output from the en- 
gine. Such engines are typically employed on aircraft, 
and can either be used in combination with propeller 
drive system to form a turboprop system, or without a 
propeller, as in a turboshaft, tu rbojet or turbofan system. 
Engines incorporating compressor blades on a single 
drive shaft are known as single axial flow compressor 
engines. Another type of engine is one which may in- 
clude two coaxial drive shafts, in what Is referred to as 
a dual axial flow compressor engine. In such an engine, 
rows of low pressure compressor blades are connected 
by a first drive shaft to a drive turisine. Downstream of 
these rows of low pressure compressor blades are rows 
of high pressure compressor blades connected to a sec- 
ond coaxial drive shaft which is driven by separate drive 
turiDines. 

[0003] Whether the engine is the single axial or dual 
axial type, the drive shafts must be capable of rotating 
at tens of thousands of Rpm's for hours at a time, under 
intense variations in temperature, acceleration, centrif- 
ugal stress, axial stress, etc. 
[0004] After years of shaft usage, circumstances have 
arisen where one of the drive shafts separates from the 
remaining portion of the shaft. Because the drive shaft 
is rotating at such high rate of speed, failure or "decou- 
pling" of the shaft will occur suddenly and rapidly. When 
a gas turbine engine experiences a shaft failure, the en- 
tire f ailu re sequence may occu r In less than one second, 
and produce a sudden catastrophic failure of the engine 
In which the rotating components of the engine up- 
stream of the failure will suddenly decelerate, while ro- 
tating components downstream of the failure will begin 
to accelerate uncontrollably. The uncontrolled acceler- 
ation downstream of the failure poses the greatest haz- 
ard, because the rotational velocity of these compo- 
nents may reach a point where the centrifugal forces on 
these components cause them to shear away from the 
drive shaft, and impact the engine housing risking pos- 
sible non-containment of these components within the 
engine housing. On a Jet aircraft, such a non-contain- 
ment could result in serious damage to the remaining 
portions of the engine, as well as damage to the aircraft 
fuselage. 



[0005] Various attempts have been made to contain 
a component burst through the engine housing. In one 
such attempt, a solid containment ring fomied of high 
strength material, such as a nickel cobalt alloy has been 

5 integrated into the outer engine housing to circumferen- 
tialty surround the rotating components of the engine. 
Although such containment rings have been successful 
in containing fragmented components within the engine 
housing, they add a significant amount of additional 

10 weight to the engine, thus sacrificing fuel economy and 
passenger capacity. The trapping of failed engine com- 
ponents within the engine itself also results extensive, 
irreparable damage to the engine, often requiring that 
the entire engine be replaced after such a failure, thus 

15 adding substantial cost to the operation of the aircraft. 
[0006] A need therefore exists to develop a warning 
protocol to identify the immediate signs of a drive shaft 
failure, and shut down the engine before the portions of 
the drive shaft downstream of the failure accelerate to 

20 a level that will place excessive stresses on the rotating 
components. Because these warning signs will appear 
only fractions of a second before the engine compo- 
nents start to fragment, it is evident that such a warning 
protocol must also be automated, preferably in thefomi 

25 of a control logic utilized by a high speed on board proc- 
essor. If it becomes possible to shut down the engine 
while it is displaying the early warning signs of shaft fail- 
ure, and before any component fragmentation occurs, 
the need for using heavy containment rings can be elim- 

30 inated. In addition, damage to the engine resulting from 
the high speed component fragmentation can be elimi- 
nated as well. Most importantly, however, the safety of 
the operational engine can be significantly improved, 
since the chances of component fragmentation can be 

35 eliminated, thus improving the safety and integrity of the 
passenger compartment. 

SUMMARY OF THE INVENTION 

40 [0007] It is a feature of the present invention to pro- 
vide a method for making a determination of immediate 
drive shaft failure and to cut off fuel flow to the engine 
when such imminent failure is detected, thus shutting 
down the engine. 

45 [0008] It Is another feature of the present Invention to 
provide an electronic system which uses a control logic 
to make a detemiination of shaft failure, and to send a 
control to signal to a shut off system to shut off the fuel 
flow to the engine in response to a detennination of shaft 

50 failure. 

[0009] According to an aspect of the present inven- 
tion, there is provided a method for controlling an oper- 
ating turbine engine, the engine containing a rotating 
shaft connecting a compressor and a turbine down- 
55 Stream of the compressor, the method comprising the 
steps of: i) detecting a shaft shear condition; and ii) shut- 
ting off fuel flow to the engine in response to detecting 
the shaft shear condition. Preferably, this method further 
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comprises the steps of: a) sensing a rotational speed of 
the shaft at two or more instances; b) calculating a rate 
of change of rotational speed of the shaft between the 
instances; and c) if the rate of change of rotational speed 
drops below a pre-determined limit, establishing a shaft 5 
shear condition. Additionally, this method further com- 
prises the steps of: a) sensing a rotational speed of the 
shaft at two or more instances; b) calculating a rate of 
change of rotational speed of the shaft between the in- 
stances; c) if the rate of change of rotational speed drops 
below a pre-determined limit: 1) sensing a pressure 
downstream of the compressor at two or more Instanc- 
es; 2) calculating a change of the pressure between the 
instances change; and 3) if the change In pressure is 
below a pre-determined limit, establishing a shaft shear 
condition. 

[0010] According to another aspect of the present in- 
vention, there is provided a method for controlling a tur- 
bine engine containing first and second coaxial rotatable 
shafts, a first row of blades connected to the first shaft 
and a second row of blades connected to the second 
shaft downstream of the first row of blades, the method 
comprising the steps of: i) sensing the rotational speed 
of the first row of blades; ii) sensing the rotational speed 
of the second row of blades; iii) comparing the rotational 
speed of the first row of blades with the second row of 
blades; and iv) if the speed of the first row of blades Is 
not at a minimum required level relative to the speed of 
the second row of blades, shutting off fuel flow to the 
engine. 

[001 1 ] According to yet an other aspect of the present 
Invention, there is provided an apparatus for controlling 
a turbine engine, the engine containing a rotatabte shaft 
connecting a compressor and a turbine downstream of 
the compressor, the apparatus comprising: a speed 
sensor adapted to sense rotational speed of the shaft; 
a processor adapted to receive and compare signals re- 
ceived from the speed sensor; and a fuel flow controller 
adapted shut off fuel flow to the engine in response to 
a signal received from the processor. 
[0012] Finally, according to another aspect of the 
present invention, there is provided an apparatus for 
controlling a turbine engine containing first and second 
coaxial rotatable shafts, a first row of blades connected 
to the first shaft and a second row of blades connected 
to the second shaft downstream of the first row of 
blades, the apparatus comprising: a speed sensor 
adapted to sense rotational speed of first row of blades; 
a speed sensor adapted to sense rotational speed of the 
second row of blades; a processor adapted to receive 
and compare signals received from the speed sensors; 
and a fuel controller adapted shut off fuel flow to the en- 
gine in response to a signal received from the processor 
indicating a rotational speed of the first row of blades 
not at a minimum level In proportion to the rotational 
speed of the second row of blades. 
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BRIEF DESCRIPTION OF THE DRAWINGS 
[0013] 

Fig. 1 Is a cross sectional view of a dual shaft gas 

turbine engine. 

Fig. 2 is a diagranri of nonnaiized deceleration ver- 
sus con^ected rotational velocity for the tow pres- 
sure compressor of a dual axial compression tur- 
10 boshaft engine. 

Fig. 3 Is a logic diagram illustrating the steps nec- 
essary for detecting shaft decoupling and the se- 
quence for shutting down the engine. 
Fig. 4 is a logic diagram illustrating the steps nec- 
is essary for detecting shaft decoupling and the se- 
quence of events which take place when one of the 
communications channels fails. 
Fig. 5 is a logic diagram illustrating the steps nec- 
essary for detecting shaft decoupling and the se- 
20 quence for shutting down the engine when a decou- 
ple is detected during Initial start up, or running at 
low power settings. 

DETAILED DESCRIPTION OF THE INVENTION 

25 

[0014] Figure 1 shows a cross sectional view of a 
standard dual shaft engine 1 0 which utilizes the dual ax- 
ial compression system which compresses and pressu- 
rizes the air entering the combustion section of the en- 
30 gine. The engine 1 0 includes rows of low pressure com- 
pressor blades 15 which rotate on an inner shaft 22. The 
speed of the low pressure compressor blade rotation is 
indicated by the parameter "NL", which is shown near 
the f onward end of the engine in Figure 1 . Downstream 
35 of the low pressure compressor blade section are rows 
of high pressure compressor blades 20. These blades 
rotate about a shaft 21 which coaxial with the low pres- 
sure shaft22. The speed of rotation for this blade section 
is indicated by the parameter "NH", which is shown near 
40 the midsection of the diagram shown in Figure 1 . Each 
of the shafts 21 and 22 are driven by separate turbines 
in the turbine section 25 of the engine. 
[0015] In operation, the combustion section 24 gen- 
erates the force necessary to drive the turbines in the 
^ turbine section 25. These turbines in turn drive the dual 
axial shafts 21 and 22 which drive and pressurize the 
airflow passing through the engine. Such an engine may 
also be operated as a turboprop type engine, by adding 
an additional turbine in the turbine section to drive a pro- 
so petler at the front of the of the engine, or by other struc- 
tural modifications known and understood by the person 
of ordinary skill in the art. 

[0016] A critical concern in the operation of any type 
of gas turbine engine is the failure of a rotating shaft. 
ss Further, in any gas turbine application where fuel flow 
to the engine could continue to some extent notwith- 
standing the failure of a rotating shaft, such as in the 
dual shaft engine application described herein, It Is de- 
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sirable to provide means to shut off the fuel flow to the 
engine upon failure of the shaft. If, for example, the shaft 
22 driving the low pressure compressor section 1 5 were 
to fracture or "decouple", the low pressure compressor 
section 1 5 would begin to suddenly decelerate, while the 
turbines driving the shaft 22, still fueled, would begin to 
accelerate uncontrollably, due to the suddenly reduced 
load on the shaft. With the onset of uncontrolled accel- 
eration of these turbines, the turbines would rapidly ex- 
ceed their maximum design speed, and begin breaking 
apart, producing high kinetic energy fragments capable 
of exiting the engine housing, unless the engine housing 
is otherwise protected by some type of containment 
structure. The entire sequence of events leading to such 
an engine failure can take much less than one second 
to occur, so the inventors herein have determined that 
such a failure must be detected at the earliest signs of 
failure, and the engine shut down must be perfonned by 
an automated system capable of reacting to the failure 
in fractions of a second. 

[0017] in the preferred embodiment of the present In- 
vention, a logic sequence has been developed which 
determines the presence of shaft decoupling based on 
changes In certain parameters of the engine operation. 
Although the preferred embodiment provides a logic se- 
quence for detecting shaft failure for the low pressure 
compressor shaft, an analogous logic sequence can be 
used for detenmining failure of the high pressure com- 
pressor shaft, as would be known and understood by 
the person of ordinary skill in the art from the following 
description. 

[0018] Figure 2 Illustrates tests performed on a com- 
puter model of a turboprop engine utilizing dual axial 
compression an'angement described with respect to fig- 
ure 1 . The vertical axis illustrates deceleration, referred 
to be the parameter "NLDot", which has been nonnal- 
ized by the parameter "Delta". Such nomnalization per- 
mits comparative analysis of parameters or cak;ulated 
amounts throughout the operating mission of the en- 
gine. The normalization of data is well known In the art 
of mathematics and statistics, and the steps necessary 
to perform such nomnalization would be known and un- 
derstood by the person of ordinary skill In the art. The 
resulting parameter NLDot/Detta is plotted on the verti- 
cal axis in units of percentage change of velocity per 
second. The horizontal axis illustrates the connected 
speed of the low pressure compressor in RPM's. Line 
30 illustrates the deceleration condition which occurs 
under a cold flame out, white the line 40 illustrates the 
deceleration condition which occurs under a hot flame 
out. Line 50 represents a line of demarcation which has 
been found to be the line which separates decelerations 
that occur during known engine anomalies, such as 
flame out, and deceleration which can only be explained 
by shaft shear of the low pressure compressor shaft. 
Line 52 represents a shaft shear which is occunring at a 
cruising altitude, while line 54 illustrates a shaft shear 
which occur under high temperature conditions. Note 



that there is very little difference between the lines for 
shaft shear under the various operating conditions, al- 
though there is a readily measurable difference between 
the lines illustrating flame out, and the lines illustrating 

5 shaft shear 

[001 9] The graph of figure 2 clearly Illustrates that de- 
celeration is the "footprint" which provides the clearest 
evidence of shaft failure, as well as being the evidence 
which appears most rapidly 

10 [0020] An advantage of utilizing the deceleration 
characteristics of the compressor portion of the shaft to 
detect shaft shear Is that there will be an increase in the 
reliability of sensors used to detect the rotational speed 
of the compressor shaft when compared to sensors 

15 used In the hot turbine shaft areas of an engine. 

[0021] Figure 3 illustrates the logto sequence 60, 
which can be utilized to immediately detect failure of the 
low pressure compressor shaft. The logic sequence Is 
perfonned over two channels of a control processor 

so known as a "Full Authority Digital Engine Control" or 
"FADEC". The FADEC is essentially a multi-channel on 
board computerthat receives a limited number of inputs 
from the aircraft pilot as well as continuous input from 
the various sensors, switches, and drivers that are 

25 placed throughout the engine. The FADEC analyzes 
these various inputs from these devices and sends con- 
trol signals back to these devices to manage their oper- 
ation. FADEC systems are well known In the art, and 
were first disclosed in U.S. Patent 4,718,229 to Riley, 

30 Issued on January 12, 1988. 

[0022] The FADEC of the prefenred embodiment of 
present invention Is capable of perfonning a logic se- 
quence that takes inputs of NL and P3 pressure to de- 
temilne whether a shaft decouple has occurred. 

35 [0023] One may choose to declare a shaft failure on 
the basis of the NLDot calculated from samples of NL; 
however, a more robust system would confimi the shaft 
failure by, for example, sensing unusual corresponding 
changes in P3. Preferably, in order to prevent inadvert- 

40 ent shut down of the engine under conditions where the 
shaft has not failed, the second parameter Is used to 
verify that a failure is taking place. 
[0024] It has been experimentally found that a param- 
eter which changes rapidly during low pressure com- 

45 pressor shaft failure Is the pressure at the entrance of 
the combustion chamber, referred to by the parameter 
"P3". This pressure is measured in the region of the en- 
gine between the downstream end of the high pressure 
compressor blades and the entrance to the combustion 

50 chamber. Experiments have demonstrated that a drop 
in the P3 pressure corresponds with shaft failure condi- 
tion. Thus, parameter can be measured as a backup to 
verify any detection of shaft failure made by measuring 
sudden decelerations in the low speed compressor. Of 

55 course, other physical parameters equally affected by 
such failure may be measured as an alternative to the 
P3 parameter. For the purpose of the following descrip- 
tion the invention will be described as incorporating the 
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measurement of the P3 parameter within the logic se- 
quence. 

[0025] The Input for deceleration can be derived from 
rotational speed sensors placed near the Input end of 
the low pressure compressor blade section, or placed 
near the shaft for the low pressure compressor. Chang- 
es in rotational speed transmitted to the FADEC may be 
used to calculate acceleration or deceleration by the 
FADEC system. The P3 pressure is derived from pres- 
sure sensors placed at the entry of the combustion sec- 
tion, measuring absolute pressure in this area. One set 
of rotational speed and pressure sensors communicate 
with one channel of the FADEC, while a second set of 
rotational speed and pressure sensors communicate 
with a second, baclcup channel of the FADEC. 
[0026] Figure 3 shows the first FADEC channel 70 
communicating with sensor inputs for NL 71 for calcu- 
lating NLDot and P3 pressure drop 72. The logic se- 
quence is as follows: 

(1) The FADEC will sample the rotational speeds, 
and calculate normalized NLDot on one of the com- 
munications channels at about 20 millisecond inter- 
vals. The actual time interval between sampling 
may vary, but in the preferred embodiment, the 
sample time interval is between 20-30 milliseconds. 

(2) If the calculated normalized NLDot exceeds the 
line of demarcation for nonnallzed NLDot (derived 
from the graph of Fig. 2) in several consecutive 
samples, then this parameter will be set and the log- 
ic sequence will move on to testing P3. In the pre- 
ferred embodiment, three successive samples of 
NL and calculations of NLDot will set the parameter, 
but a differing number of successive samples may 
be tal^en, such as one sample, or four or more sam- 
ples. 

(3) If the P3 value is below the predicted value for 
P3 under those particular engine operating condi- 
tions, then the logic will declare a shaft shear con- 
dition. In the preferred embodiment, the shaft shear 
condition is declared when the P3 value is 20psia 
or more beiow the predicted value. However, the dif- 
ference between the measured P3 and the predict- 
ed P3 necessary to declare a shaft failure may vary, 
such as would be understood by the person of or- 
dinary skill in the art. 

(4) If the logic declares a shaft shear, than confir- 
mation of the finding Is made by sending a signal 
75 to backup channel 80, which is simultaneously 
perfonning the same sampling and comparison 
tests 81-83, that are being perfomried on channel 
70. If channel 80 verifies the outcome, it sends a 
signal 85 back to channel 70, and both channels 
send signals for engine shutdown. 

(5) Both channels will then agree and send signals 
to Field Programmable Gate Array Circuits (FP- 
GA's) 76 and 86 respectively, whk:h receive the sig- 
nals from channels 70 and 80 and order a fuel cutoff 



to the engines, thus immediately decelerating the 
engine displaying the shaft shear condition. 

[0027] The advantage of this logic sequence is three- 
5 fold: 

(1) The logic sequence is capable of declaring and 
verifying a shaft failure in a total time of about 
80-100 milliseconds, depending upon the exact 

10 processing speed of the FADEC. Given the fact that 
fragmentation by the turbines downstream of the 
failure occurs less than one second after the shaft 
failure, the response time of 50-60 milliseconds 
gives the FADEC system the ability to shut down 
15 the engine before extensive damage is caused to 
the engine. 

(2) The logic sequence and FADEC processor re- 
sponds more rapidly to the failure than any human 
controller could ever respond. If the information on 

20 normalized NLDot and P3 were sent a to a pilot in 
a cockpit, even If the pilot were warned by a warning 
light of a sensed failure, the response time would 
be at least 5-25 seconds, which is not sufficiently 
fast to prevent damage to the engine. The logic se- 
25 quence disclosed herein can be performed and ex- 
ecuted in a time frame that Is faster than nonnai hu- 
man reflexes, and fast enough to prevent extensive 
damage to the engine or damage to the fuselage 
resulting from uncontained failure. 
30 (3) The logic sequence utilizes multiple backups 
and logic agreements to prevent engine shut down 
under spurious conditions. The design of verifying 
normalized NLDot with multiple successive sam- 
ples, the use of the P3 parameter for secondary 
35 confimiation, and the communication with a second 
channel f or tertiary CO nfimnati on, all serve to prevent 
engine shut down unless all the data points to a 
shaft failure. This prevents the engine from being 
shutdown under spurious, or unpredtotable condi- 
40 tions which are not the result of shaft failure. Ulti- 
mately, this pennits safe usage of the logic system 
under a variety of different flight conditions. 

[0028] Figure 4 illustrates the system as It operates 
45 when one of the two channels communicating with the 
FADEC is not available. This might occur when one of 
the channels is not able to communicate with one of the 
sensors, or the channel has failed to connect with the 
FADEC processor. In figure 4, channel 70 is the opera- 
50 tional channel, while channel 60 is the channel which is 
not functioning. In this mode of operation, the steps of 
checking an excessive NLDot 71 , checking the P3 step 
down 72 and declaring the shaft shear failure 73 occur 
as normal. However, when the channel 60 is not avail- 
55 able, it defaults to "Confirmed" status and confirms the 
conclusion reached on channel 70. The advantage of 
such a logic sequence is that the aircraft does not have 
to be taken out of servtee to repair the failure on the out 
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of service channel 60 since the other channel 70 re- 
mains operable, and perfomns all the necessary steps 
for detennining shaft failure. As a result, the aircraft is 
able to extend its "in-service" tinne while still performing 
the necessary failure checks. 
[0029] Figures 1 -4 are addressed to logic sequences 
which are preferred for use when the aircraft engine is 
fully running, such as would occur during flight at a 
cruise altitude or during take off. However, other logic 
sequences are preferably used during the initial start up 
of the engine, and the sub-idle run up of the engine. 
These logic sequences are illustrated In figures 5 and 6 
respectively. 

[0030] Figure 5 Illustrates the logic sequence which is 
employed when the engine goes through its initial start 
up after ignition. "NH" represents the rotational velocity 
of the high speed compressor while "X%" represents the 
percent of velocity achieved by the high speed compres- 
sor in comparison to the maximum full throttle velocity 
for this compressor. "NL" represents the rotational ve- 
locity of the low speed compressor while "Minimum%" 
represents the percent of velocity achieved by the low 
speed compressor In comparison to the full throttle ve- 
locity. The actual values for the parameters X% and Min- 
imum % will vary depending upon the type and design 
of engine involved, as would be understood by the per- 
son of ordinary skill in the art. 
[0031] However, the Minimum% is always a function 
of the X%. In the preferred embodiment of the invention, 
where the logic sequence is applied to a turboprop en- 
gine, such as the type known as "PW150A", the pre- 
ferred X% is between about 61% to 64%, representing 
between 19,000 and 20,000 RPM's. For this particular 
X%, the Minimum is between 27% and 28%, represent- 
ing 7500 to 7510 RPM's. 

[0032] The logic sequence of figure 5 operates by first 
testing the value for NH and assigning it a percentage 
of maximum RPM (X%). The value of NL is then tested 
and assigned a percentage of maximum RPM (Mini- 
mum%). If the Minimum% of RPM for the low speed 
compressor is not met for each value of X% of the high 
speed compressor measured at preferably three 20 mil- 
lisecond intervals, than the engine start is aborted by 
shutting off fuel to the engine. 
[0033] The logic sequence for the run up portion of 
the start prior to idle is essentially the same as that used 
for the initial start as shown in figure 5. NH is measured 
and assigned a value (X%) and NL is measured and as- 
signed a value (Mlnimum%). If the Mlnimum% of RPM 
for the low speed compressor is not met for each value 
of X% of the high speed compressor, with measure- 
ments taken at multiple intervals, the engine start is 
aborted by shutting off fuel flow to the engine. 
[0034] While the Invention has been shown and de- 
scribed with respect to specific embodiments thereof, 
this is forthe purpose of illustration rather than limitation, 
and other variations and modifteations of the specific 
embodiments herein shown and described wilt be ap- 



parent to those skilled in the art within the intended spirit 
and scope of the invention as set forth in the appended 
claims. 

5 

Claims 

1. A method for controlling a turbine engine (10) con- 
taining first and second coaxial rotatable shafts (21 , 

10 22), a first row of blades (15) connected to the first 
shaft (22) and a second row of blades (20) connect- 
ed to the second shaft (21) downstream of the first 
row of blades (1 5), the method comprising the steps 
of: 

15 

\) sensing the rotational speed of the first row 
of blades (15); 

ii) sensing the rotational speed of the second 
row of blades (20) ; 
20 ill) comparing the rotational speed of the first 

row of blades (15) with the second row of 
blades (20); and 

iv) if the speed of the first row of blades (15) 
decelerates below a minimum required level 
25 relative to the speed of the second row of 

blades (20), shutting off fuel flow to the engine 
(10). 

2. The method claimed in claim 1 , wherein the minl- 
30 mum required level is about 27-28% of maximum 

speed forthe first row of blades (15) when the sec- 
ond row of blades (20) is rotating at between 61%- 
65% of maximum speed for the second row of 
blades (20). 

35 

3. An apparatus for controlling a turbine engine (10) 
containing first and second coaxial rotatable shafts 
(21 , 22), a first row of blades (15) connected to the 
first shaft (22) and a second row of blades (20) con- 

40 nected to the second shaft (21 ) downstream of the 
first row of blades (15), characterized In that: 

a speed sensor to sense rotational speed of the 
first row of blades (15); 
45 a speed sensor to sense rotational speed of the 

second row of blades (20) ; 
a processor (60) to receive and compare sig- 
nals received from the speed sensors; and 
a fuel controller (76, 86) adapted to shut off fuel 
so flow to the engine (1 0) in response to a signal 

received from the processor (60) indicating a 
rate of change of rotational speeds of one of 
the first and second shafts (21 , 22) caused by 
decelerating of one shaft below a minimum 
S5 speed level in proportion to the rotational speed 

of the other of the first and second shafts. 

4. The apparatus claimed in claim 3, wherein a pres- 
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sure sensor is adapted to sense pressure down- 
stream of the compressor (15, 20). 

5. The apparatus claimed in claim 3 or 4, wherein the 
processor is a digital system. 5 

6. The apparatus claimed in claim 5, wherein the proc- 
essor (60) is a full authority digital engine control. 

7. The apparatus claimed In any of claims 3 to 6, io 
wherein the fuel controller Includes a rapid re- 
sponse gate array system controlling one or more 
fuel control valves. 
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